Technologies for acquiring and retaining packets on a network in order to discover causes of trouble occurring on the network have been disclosed (for example, refer to Patent Literature 1, Patent Literature 2, Patent Literature 3, and Patent Literature 4). Since the storage capacity of a network monitoring device that acquires and retains packets on a network is limited, there has been a demand for not only a packet retaining function that enables acquisition and retaining of packets but also an overwriting prevention function that enables prevention of overwriting of packets when an error occurs on the network.